Update a member of a group
/groups/{group_id}/members/{id}Changes the member's role and signatory flag, whichever you send, and returns the member. A user who is not a member returns 404, and if the editor and viewer group roles are not set up it returns 409 conflict. Callers need update rights on the group, as for PATCH /groups/{id}; otherwise 403 missing_permission. dry_run shows the result without saving it. Emits group_member.updated with the changed fields, and nothing when nothing changed. It sends no email. Sending the previous values undoes it.
Path parameters
The group's id, a uuid. An unknown group, or one your organisations cannot see, returns 404.
The member's user id.
Query parameters
Validate and run the call without committing it, returning what the real call would return with
meta.dry_runset.
Request body
application/json, required · GroupMemberUpdate
- One of:
What the member may do in the group:
editororviewer.editor,viewer Whether the member signs for the group.
{
"role": "viewer"
}Responses
{
"data": {
"id": "9a9d1c5e-4f2b-4c8e-9a7d-2f1e6b3c4d5a",
"first_name": "string",
"last_name": "string",
"email": "string",
"role": "editor",
"signatory": true,
"created_at": "2026-06-12T10:00:00+00:00",
"updated_at": "2026-06-12T10:00:00+00:00"
}
}Authorization failed. error.code is missing_permission when the caller may not change the group, with the permissions that would allow it in details, or one of missing_scope, scope_disabled, org_disabled, ip_blocked, user_disabled.
The request conflicts with existing state (error.code = conflict),
e.g. a compliance flow with the requested name already exists.
The request can't be processed (HTTP 422): validation_failed with one ErrorDetail per
problem, or a code documented on the operation.
Examples
curl -X PATCH https://your-org-domain/kong/core/api/v2/groups/{group_id}/members/{id}\
-H "Authorization: Bearer $HELM_API_KEY"\
-H "Content-Type: application/json"\
-d '{
"role": "viewer"
}'